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REMARKS 

Applicants appreciate the thorough review of the present application as reflected in 
the Official Action mailed May 6, 2004. However, Applicants submit that the present 
application is patentable over the cited reference as the cited reference does not disclose or 
suggest the use of a certificate extension as recited in the claims. 

The IDS 

Applicants wish to bring to the Examiner's attention an IDS that is being submitted 
concurrently herewith. Applicants request that an initialed copy of the PTO-1449 form be 
returned with any subsequent communication. 

The Claims Are Not Anticipated 

Claims 1-60 stand rejected under 35 U.S.C. § 102(b) as anticipated by United States 
Patent No. 5,844,986 to Davis (hereinafter "Davis")- Under 35 U.S.C. § 102, "a claim is 
anticipated only if each and every element as set forth in the claim is found, either expressly 
or inherently described, in a single prior art reference." M.P.E.P. § 2131 (quoting Verclegaal 
Bros. v. Union Oil Co., 814 F.2d 628, 631, 2 U.S.P.Q.2d 1051, 1053 (Fed. Cir. 1987)). "The 
fact that a certain result or characteristic may occur or be present in the prior art is not 
sufficient to establish the inherency of that result or characteristic. To establish inherency, 
the extrinsic evidence 'must make clear that the missing descriptive matter is necessarily 
present in the thing described in the reference, and that it would be so recognized by persons 
of ordinary skill. Inherency, however, may not be established by probabilities or 
possibilities. The mere fact that a certain thing may result from a given set of circumstances 
is not sufficient.™ M.P.E.P. § 21 12 (citations omitted) (emphasis added). 

A finding of anticipation further requires that there must be no difference between the 
claimed invention and the disclosure of the cited reference as viewed by one of ordinary skill 
in the art. See Scripps Clinic & Research Foundation v. Genentech Inc., 18 U.S.P.Q.2d 1001 
(Fed. Cir. 1991). Thus, anticipation requires that a single prior art reference disclose each 
and every element of the anticipated claim. 

The Official Action asserts that Davis teaches all of the recitations of each of the 
pending claims. In particular, with respect to Claims 1 and 21, the Official Action cites to 
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col. 4, line 27 and col. 4, line 8 of Davis as teaching the recitations of the claims regarding 
the application rules information. Official Action, p. 2. These cited portions of Davis appear 
to described the standard use of a certificate to authenticate the source of a BIOS upgrade. 
See Davis, col. 4, lines 1 9-46. There is no mention of a certificate extension or rules for the 
application of an update being contained in a certificate extension. 

In contrast to the cited portions of Davis, Claim 1 recites, in part: 

obtaining a certificate associated with the update image, the certificate 
having update application rules in at least one extension of the certificate; 

extracting the update application rules from the at least one extension of 
the obtained certificate; and 

selectively updating the programmable memory based on the update image 
and the update application rules extracted from the obtained certificate, (emphais 
added). 

Corresponding recitations are found in Claims 21 and 41. Applicants submit that at least the 
highlighted portions of Claim 1 are neither disclosed nor suggested by the cited portions of 
Davis. 

Applicants initially note that they are not claiming merely the idea of using a 
certificate to authenticate an update image but, in fact, are claiming the specific use of an 
extension of a certificate to provide rules for the application of the update. Thus, Claim 1 
recites that the certificate includes "update application rules in at least one extension of the 
certificate," the extraction of the rules from the extension and "updating the programmable 
memory based on the update image and the update application rules extracted from the 
obtained certificate." See Claim 1 (emphasis added). 

The cited portion of Davis at col. 4, line 8 describes determining the validity of a new 

BIOS program. This validity determination appears to be based on the BIOS program itself, 

not based on rules provided in a certificate extension. For example, Davis states: 

Once the authentication operations have been performed, in step 160, the 
cryptographic coprocessor can make a determination as to the validity of the new 
BIOS program. For example, the digital signature supplied with the "new BIOS 
program" may be valid, but the revision date may be inappropriate (e.g. older than the 
currently installed BIOS). If the new BIOS is determined to be invalid, it is deleted by 
the cryptographic coprocessor and is never used (step 170). If the new BIOS is valid, 
the new BIOS program is made operational and the previous BIOS program is deleted 
(step 180). Note that at this point, it would be normal to reboot the computer system 
to assure system-wide consistency. 
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Davis, col. 4, lines 7-18. Thus, the only example of the determination that the "new BIOS" is 
invalid is the comparison of the revision date. There is no indication that any "update rules" 
are provided in an extension of a certificate as recited in Claim 1. In fact, the only mention of 
the certificate appears to be in connection with authentication. See e.g., Davis, col. 3, line 63 
to col. 4, line 4 and lines 19-46. 

The cited portion of Davis at col. 4, line 27 also does not disclose or suggest the use 
of a certificate extension to provide update rules as recited in Claim 1. In particular, col. 4, 
line 27 of Davis appears to only provide further details regarding authentication. Thus, Davis 
states: 

To support this digital signature-based method of BIOS authentication, the 
digital signature embedded in the distribution BIOS software upgrade should be 
underwritten or endorsed by an industry association, or a similar organization or 
procedure. The participants in this industry association are the BIOS vendors who 
want to be able to field upgrade their BIOS code. One of the functions of this industry 
association is to issue digital certificates to its BIOS vendor members, essentially 
assigning a digital certificate to each vendor to be used in BIOS upgrade software. 
This association provides its public key to be used by the cryptographic coprocessor 
during the BIOS authentication procedure. The cryptographic coprocessor will be 
preloaded with the public key of the industry association for BIOS vendors so that it 
will be able to verify any digital signature embedded in the BIOS upgrade code. 
Alternatively, the cryptographic coprocessor may be preloaded with another public 
key that may be used to authenticate a certificate chain to obtain this industry 
association public key. The BIOS upgrade code could be encrypted if necessary (to 
protect the code from being reverse engineered for example). Since the digital 
signature or the certificate issued by the industry association normally represents the 
authenticity of a reputable or credible BIOS vendor, an intruder cannot corrupt the 
BIOS code (unless of course he or she somehow obtains secret private keys used to 
create such signatures or certificates) either directly or indirectly by virus attack. 

Davis, col. 4, lines 19-46. This portion of Davis describes assigning a digital certificate to 
vendors for use in an authentication procedure, but there is no indication that an extension of 
the digital certificate is used to provide update rules or that update rules are provided at all. 

In light of the above discussion, Applicants submit that each of the recitations of the 
independent claims are not disclosed or suggested by the cited portions of Davis. 
Accordingly, Applicants submit that Claims 1,21 and 41 are not anticipated by Davis. 

While each of the dependent claims is patentable as depending from a patentable base 
claim, Applicants submit that certain of the dependent claims are also separately patentable. 
For example, Claims 2 through 7, 22 through 27 and 42 through 47 each recite specific 
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details about the rules provided in the certificate extension. Because Davis does not describe 
including rules in a certificate extension, it follows that Davis does not describe the recited 
details regarding the rules provided in the certification extension. Accordingly, Applicants 
submit that these claims are separately patentable for at least these additional reasons. 

Conclusion 

In light of the above discussion, Applicants submit that the present application is in 
condition for allowance, which action is respectfully requested. 

It is not believed that an extension of time and/or additional fee(s)-including fees for 
net addition of claims-are required, beyond those that may otherwise be provided for in 
documents accompanying this paper. In the event, however, that an extension of time is 
necessary to allow consideration of this paper, such an extension is hereby petitioned under 
37 C.F.R. § 1 . 1 36(a). Any additional fees believed to be due in connection with this paper 
may be charged to our Deposit Account No. 09-0461. 
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